Cargo resolves different versions of dependencies (with different MSRV) from Cargo 1.60 and up

[johannesvollmer]

Hi! I'm using GitHub Workflows to check PRs. I also added a check ensuring that all PRs conform to the rust-version defined in the projects Cargo.toml. However, it seems I got something wrong. Do you have an idea what could be the problem? :)

Here's what I've got:

verify-msrv:
    runs-on: ubuntu-latest
    name: verify minimum supported rust version (ubuntu)
    timeout-minutes: 30

    # we are using the `cargo-msrv` app
    # https://github.com/foresterre/cargo-msrv

    steps:
      - uses: actions/checkout@v2

      - name: Install or use cached foresterre/cargo-msrv
        uses: baptiste0928/cargo-install@v1
        with:
          crate: cargo-msrv

      - name: Verify the Rustc version declared in `cargo.toml`
        run: |
          cargo-msrv verify

(see https://github.com/johannesvollmer/exrs/blob/a4aa0acc9fe9d4467eabf47cb647ff99dc7b10b5/.github/workflows/rust.yml#L39)

I checked that your tool returns exit codes. Somehow, the check does not fail though. This is the output I get from GitHub:

Run cargo-msrv verify
  cargo-msrv verify
  shell: /usr/bin/bash -e {0}
Fetching index
Verifying the Minimum Supported Rust Version (MSRV) for toolchain x86_64-unknown-linux-gnu
Using check command cargo check

(see https://github.com/johannesvollmer/exrs/actions/runs/5441981161/jobs/9896601827?pr=191)

Shouldn't there be more text? The same command correctly fails on my local machine. Maybe you have an idea? :)

[foresterre]

Happy to help if I can!

Attempts to reproduce

I shallow cloned your repo and got the following (locally):

Making sure I'm running the latest release, and not the latest beta

❯ cargo msrv --version
cargo-msrv 0.15.1

Showing the MSRV

❯ cargo msrv show
Fetching index
1.59.0

Running `cargo msrv` to find the MSRV

NB: In this case it will never go below the currently set rust-version, which is 1.59. I also removed the rust-version and ran the test again; then the MSRV is still 1.59, because rayon-core requires 1.59 or newer.

❯ cargo msrv
Fetching index
Determining the Minimum Supported Rust Version (MSRV) for toolchain x86_64-unknown-linux-gnu
Using check command cargo check

Check for toolchain '1.51.0-x86_64-unknown-linux-gnu' failed with:
┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ warning: `rust-version` is not supported on this version of Cargo and will be ignored                                      │
│                                                                                                                            │
│ this Cargo does not support nightly features, but if you                                                                   │
│ switch to nightly channel you can add                                                                                      │
│ `cargo-features = ["rust-version"]` to enable this feature                                                                 │
│     Updating crates.io index                                                                                               │
│  Downloading crates ...                                                                                                    │
│   Downloaded spin v0.9.8                                                                                                   │
│   Downloaded simd-adler32 v0.3.5                                                                                           │
│   Downloaded miniz_oxide v0.7.1                                                                                            │
│   Downloaded getrandom v0.2.10                                                                                             │
│   Downloaded futures-sink v0.3.28                                                                                          │
│   Downloaded futures-core v0.3.28                                                                                          │
│   Downloaded memoffset v0.9.0                                                                                              │
│   Downloaded quote v1.0.29                                                                                                 │
│   Downloaded pin-project-internal v1.1.2                                                                                   │
│   Downloaded unicode-ident v1.0.9                                                                                          │
│   Downloaded zune-inflate v0.2.54                                                                                          │
│   Downloaded pin-project v1.1.2                                                                                            │
│   Downloaded num_cpus v1.16.0                                                                                              │
│   Downloaded bit_field v0.10.2                                                                                             │
│   Downloaded lock_api v0.4.10                                                                                              │
│   Downloaded crossbeam-utils v0.8.16                                                                                       │
│   Downloaded proc-macro2 v1.0.63                                                                                           │
│   Downloaded crossbeam-epoch v0.9.15                                                                                       │
│   Downloaded crossbeam-channel v0.5.8                                                                                      │
│   Downloaded syn v2.0.23                                                                                                   │
│   Downloaded libc v0.2.147                                                                                                 │
│    Compiling autocfg v1.1.0                                                                                                │
│     Checking cfg-if v1.0.0                                                                                                 │
│    Compiling libc v0.2.147                                                                                                 │
│    Compiling proc-macro2 v1.0.63                                                                                           │
│    Compiling quote v1.0.29                                                                                                 │
│    Compiling crossbeam-utils v0.8.16                                                                                       │
│     Checking scopeguard v1.1.0                                                                                             │
│    Compiling unicode-ident v1.0.9                                                                                          │
│    Compiling futures-core v0.3.28                                                                                          │
│     Checking simd-adler32 v0.3.5                                                                                           │
│    Compiling rayon-core v1.11.0                                                                                            │
│     Checking futures-sink v0.3.28                                                                                          │
│ error: edition 2021 is unstable and only available with -Z unstable-options.                                               │
│                                                                                                                            │
│ error: could not compile `rayon-core`                                                                                      │
│                                                                                                                            │
│ To learn more, run the command again with --verbose.                                                                       │
│ warning: build failed, waiting for other jobs to finish...                                                                 │
│ error: build failed                                                                                                        │
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Check for toolchain '1.61.0-x86_64-unknown-linux-gnu' succeeded

Check for toolchain '1.56.1-x86_64-unknown-linux-gnu' failed with:
┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ error: package `exr v1.6.5 (/home/marwen/ws/cargo-msrv-exrs)` cannot be built because it requires rustc 1.59.0 or newer,   │
│ while the currently active rustc version is 1.56.1                                                                         │
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘

Check for toolchain '1.58.1-x86_64-unknown-linux-gnu' failed with:
┌────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ error: package `rayon-core v1.11.0` cannot be built because it requires rustc 1.59 or newer, while the currently active    │
│ rustc version is 1.58.1                                                                                                    │
└────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
Check for toolchain '1.59.0-x86_64-unknown-linux-gnu' succeeded
   Finished The MSRV is: 1.59.0   ███████████████████████████████████████████████████████████████████████████████████ 00:00:47

Running cargo msrv verify (I expected it to succeed since the MSRV was found to be 1.59)

❯ cargo msrv verify
Fetching index
Verifying the Minimum Supported Rust Version (MSRV) for toolchain x86_64-unknown-linux-gnu
Using check command cargo check
   Finished Satisfied MSRV check: 1.59.0 ████████████████████████████████████████████████████████████████████████████ 00:00:00

Setting the MSRV to 1.58 test whether that would fail (as expected)

❯ cargo msrv set 1.58
Fetching index

❯ cargo msrv verify
Fetching index
Verifying the Minimum Supported Rust Version (MSRV) for toolchain x86_64-unknown-linux-gnu
Using check command cargo check
   Done Bad check for 1.58.1      ███████████████████████████████████████████████████████████████████████████████████ 00:00:00
   Failed check command cargo check didn't succeed
Crate source was found to be incompatible with its MSRV '1.58.1', as defined in '/home/marwen/ws/cargo-msrv-exrs/Cargo.toml'

❯ echo $?
1

Running some commands on linked commit `a4aa0acc`

❯ cargo msrv set 1.59
Fetching index

❯ cargo msrv --output-format json verify
{"reason":"fetching-index"}
{"reason":"mode","mode":"verify-msrv","toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"installing","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"checking","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"check-complete","version":"1.59.0","step":0,"total_steps":1,"success":true,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"verify-complete","success":true,"msrv":"1.59.0","toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}

After the above I checked with your linked commit.

git fetch --depth=1 upstream a4aa0acc9fe9d4467eabf47cb647ff99dc7b10b5
remote: Enumerating objects: 9, done.
remote: Counting objects: 100% (9/9), done.
remote: Compressing objects: 100% (4/4), done.
remote: Total 5 (delta 2), reused 3 (delta 0), pack-reused 0
Unpacking objects: 100% (5/5), 439 bytes | 109.00 KiB/s, done.
From github.com:johannesvollmer/exrs
 * branch            a4aa0acc9fe9d4467eabf47cb647ff99dc7b10b5 -> FETCH_HEAD

❯ git checkout a4aa0acc9fe9d4467eabf47cb647ff99dc7b10b5
M       Cargo.toml
Note: switching to 'a4aa0acc9fe9d4467eabf47cb647ff99dc7b10b5'.

❯ git checkout Cargo.toml
Updated 1 path from the index

❯ cargo msrv show
Fetching index
1.59.0

❯ cargo msrv verify
Fetching index
Verifying the Minimum Supported Rust Version (MSRV) for toolchain x86_64-unknown-linux-gnu
Using check command cargo check
   Finished Satisfied MSRV check: 1.59.0 ████████████████████████████████████████████████████████████████████████████ 00:00:00
❯ echo $?
0

Request for more information :)

I checked that your tool returns exit codes. Somehow, the check does not fail though. This is the output I get from GitHub

For what MSRV do you expect it to fail? Running it locally suggests the MSRV is 1.59 (that's equivalent to the rust-version defined in the Cargo manifest), so running cargo msrv verify on 1.59 should succeed (with exit code 0).

Shouldn't there be more text? The same command correctly fails on my local machine. Maybe you have an idea? :)

There should be more text indeed. Can you perhaps try the json output format to confirm it has nothing to do with the indicatif based formatter used by default:

cargo msrv --output-format json verify

-> I'm running a pipeline with the above here: https://github.com/foresterre/cargo-msrv-exrs/actions/runs/5444486707/jobs/9902405414?pr=1

[johannesvollmer]

Hi! Thanks for your help so far, and for taking the time to help me.

I realize I forgot some important information, sorry. The main/master branch is fine. But a currently open PR should fail, which is the branch f16_batch_conversion.

The reason why I expect it to fail is because a dependency (half-rs) was updated in this PR, which requires a newer Rust version than we currently have. (The new version of that dependency has a newer MSRV, 1.70, see half-rs/Cargo.toml:rust-version, but we have 1.59).

Running cargo msrv verify on that branch locally fails, as expected. But it doesn't fail in the CI on the same branch.
For this reason, in master, we had to restrict the dependency to avoid the newest version using the syntax half = ">=2.1.0, <2.3" .

[johannesvollmer]

There should be more text indeed. Can you perhaps try the json output format to confirm it has nothing to do with the indicatif based formatter used by default:
cargo msrv --output-format json verify

Yes I'll do that :)

[foresterre]

I realize I forgot some important information, sorry. The main/master branch is fine. But a currently open PR should fail, which is the branch f16_batch_conversion.

The reason why I expect it to fail is because a dependency (half-rs) was updated in this PR, which requires a newer Rust version than we currently have. (The new version of that dependency has a newer MSRV, 1.70, see half-rs/Cargo.toml:rust-version, but we have 1.59).

An initial reply; I will need to dive a bit deeper before I can conclude anything, however, when I check out the branch (which defines rust-version as 1.59) and run:

1) cargo msrv verify

rm -f Cargo.lock && cargo msrv --output-format json verify
{"reason":"fetching-index"}
{"reason":"mode","mode":"verify-msrv","toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"installing","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"checking","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"check-complete","version":"1.59.0","step":0,"total_steps":1,"success":true,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"verify-complete","success":true,"msrv":"1.59.0","toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}

2) cargo +1.70.0 check && cargo msrv verify

(I use 1.70 here explicitely, but latest stable would be fine too)

rm -f Cargo.lock && cargo check && cargo msrv --output-format json verify
    Updating crates.io index
    Finished dev [optimized + debuginfo] target(s) in 0.58s
{"reason":"fetching-index"}
{"reason":"mode","mode":"verify-msrv","toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"installing","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"checking","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"check-complete","version":"1.59.0","step":0,"total_steps":1,"success":false,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}
{"reason":"verify-complete","success":false,"toolchain":"x86_64-unknown-linux-gnu","check_cmd":"cargo check"}

I get different results, based on which Rust (or really Cargo) version resolves the Cargo.lock file. Both use resolver version = 3.

[johannesvollmer]

Fails locally for me, even after cargo update. This is what I got for the branch f16_batch_conversion:

{"reason":"fetching-index"}
{"reason":"mode","mode":"verify-msrv","toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"installing","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"checking","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"check-complete","version":"1.59.0","step":0,"total_steps":1,"success":false,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"verify-complete","success":false,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
Crate source was found to be incompatible with its MSRV '1.59.0', as defined in 'C:\Users\JohannesVollmer\Documents\Github\exrs\Cargo.toml'

Cargo.lock version = 3

Edit: Wait, it also fails for master now, what is happening :o

exrs> git checkout master

exrs> cargo-msrv show
1.59.0

exrs> cargo check
    Finished dev [optimized + debuginfo] target(s) in 0.09s

exrs> cargo-msrv --output-format json verify
{"reason":"fetching-index"}
{"reason":"mode","mode":"verify-msrv","toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"installing","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"checking","version":"1.59.0","step":0,"total":1,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"check-complete","version":"1.59.0","step":0,"total_steps":1,"success":false,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}
{"reason":"verify-complete","success":false,"toolchain":"x86_64-pc-windows-msvc","check_cmd":"cargo check"}

Crate source was found to be incompatible with its MSRV '1.59.0', as defined in 'C:\Users\JohannesVollmer\Documents\Github\exrs\Cargo.toml'

exrs> rustc --version
rustc 1.70.0 (90c541806 2023-05-31)

[foresterre]

exrs> rustc --version
rustc 1.70.0 (90c541806 2023-05-31)

Your stable Rust version shouldn't matter for cargo-msrv, all calls to Cargo go through rustup run with a specific toolchain.

Edit: Wait, it also fails for master now, what is happening :o

It may be still using an old lock file, especially since it is in the gitignore, so you won't be notified on switching branches.

[foresterre]

I created a new crate for minimal reproduction, and tested this issue with all toolchains from Rust 1.56 - 1.70 here: https://github.com/foresterre/wow-cargo

The resolver behaviour really seems to change from Rust 1.59 to Rust 1.60.

I also checked the cargo changelog: https://github.com/rust-lang/cargo/blob/master/CHANGELOG.md#cargo-160-2022-04-07

To me, there is nothing which explicitely stands out: there are no changes to the resolver itself.

[foresterre]

I asked on Zulip in the t-cargo channel.

There is a Cargo issue open: rust-lang/cargo#10623

The problem is caused by the new dep: syntax instroduced with Cargo 1.60.

This is an issue with Cargo, but not one that's easy to fix. The issue comes because egui uses the new dep: syntax. Older Cargos don't know how to interpret this syntax and so skip parsing the version. Cargo could error on versions that they don't know how to interpret, but then you would be unable to build older versions using an older cargo just because newer versions used a newer feature. The correct solution here is for Cargo to keep track of a reason why any given package/version/feature cannot be selected and display it when relevant. Unfortunately the "when relevant" hard is a really hard feature. There are often hundreds of "reasons" that relate to the final resolution/error, only a handful of which are actually interesting to the user. We might be able to make incremental progress on these simple cases, but I am saving my effort for the multi year project of using pubgrub for our error messages.

-- rust-lang/cargo#10688 (comment)

Thanks to @Eh2406 on Zulip for pointing me to Cargo issue.

---

I'm thinking about what to do from here; there doesn't seem to be a proper solution (at first sight at least).

[johannesvollmer]

It may be still using an old lock file, especially since it is in the gitignore, so you won't be notified on switching branches.

I think I ran cargo update after switching the branch to exclude that possibility. But maybe I got mixed up

[johannesvollmer]

When I tried cargo +1.70.0 check yesterday (and a few other rustc versions), it never succeeded, because it couldn't select an appropriate version for half or image dependency. I didn't read the manual on that command though

[johannesvollmer]

But independent of dependency management, the following conditions should always lead to a failure, but somehow succeed:

• half = "^2.3" (their rust-version being 1.70)
• Cargo.toml: rust-version = 1.59

I don't think it's possible that Cargo will ever select a version of half below 2.3?

Therefore, it's perhaps a caching issue in the pipeline. I think I'll try some kind of clean build without caching in the pipeline